CVE-2022-31156

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>gradle62</name>
	<range><lt>7.5.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gradle is a build tool. Dependency verification is a security feature
	in Gradle Build Tool that was introduced to allow validation of
	external dependencies either through their checksum or cryptographic
	signatures. In versions 6.2 through 7.4.2, there are some cases in
	which Gradle may skip that verification and accept a dependency that
	would otherwise fail the build as an untrusted external artifact. This
	can occur in two ways. When signature verification is disabled but the
	verification metadata contains entries for dependencies that only have
	a `gpg` element but no `checksum` element. When signature verification
	is enabled, the verification metadata contains entries for
	dependencies with a `gpg` element but there is no signature file on
	the remote repository. In both cases, the verification will accept the
	dependency, skipping signature verification and not complaining that
	the dependency has no checksum entry. For builds that are vulnerable,
	there are two risks. Gradle could download a malicious binary from a
	repository outside your organization due to name squatting. For those
	still using HTTP only and not HTTPS for downloading dependencies, the
	build could download a malicious library instead of the expected one.
	Gradle 7.5 patches this issue by making sure to run checksum
	verification if signature verification cannot be completed, whatever
	the reason. Two workarounds are available: Remove all `gpg` elements
	from dependency verification metadata if you disable signature
	validation and/or avoid adding `gpg` entries for dependencies that do
	not have signature files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2022-31156</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2022-31156</url>
    </references>
    <dates>
      <discovery>2022-07-14</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>